---
title: MIPS EJTAG
---
<h1>MIPS EJTAG Application</h1>

<p>This application is used for programming and debugging MIPS processors
implementing the EJTAG protocol.</p>

<p>The pinout is that of the MSP430 FET, so an adapter will be needed
for debugging targets such as the Linksys WRT54G routers.</p>

<h2>Clients</h2>

<p>A simple client in Python is available in svn as `goodfet.mips'.</p>

<h2>Status</h2>

<p>This is a very new target, and it is not yet verified to be
useful or even functional.</p>

<h2>Development</h2>

<p>Prior to any transaction, the SETUP (0x10) verb should be sent to
the JTAG application to properly set the I/O pin directions.  After
that, the START (0x20) and STOP (0x21) verbs may be used to enter and
exit the TAP.  HALTCPU (0xA0) and RELEASECPU (0xA1) should be used to
stop the CPU during memory accesses, releasing afterward.</p>

<p>All reads and writes are 32-bit, but 64-bit support might be added
once we have acquired test hardware.  IR_SHIFT (0x80) and DR_SHIFT
(0x80) are available for raw access to JTAG, but higher level
functions are also implemented for convenience and speed.</p>

<h2>Verbs</h2>

<p>The following verbs are supported.</p>

<table border="1">
<tr><th>Hex</th><th>#define</th><th>Description</th></tr>
<tr><td>0x02</td><td>PEEK</td><td>Read word from memory at int32[0].</td></tr>
<tr><td>0x03</td><td>POKE</td><td>Write int32[1] to memory at in32[0].</td></tr>
<tr><td>0x10</td><td>SETUP</td><td>Configure I/O pins.</td></tr>
<tr><td>0x20</td><td>START</td><td>Begin to debug by JTAG.</td></tr>
<tr><td>0x21</td><td>STOP</td><td>End JTAG debugging.</td></tr>
<tr><td>0x7E</td><td>NOK</td><td>No Operation</td></tr>

<tr><td>0x80</td><td>IR_SHIFT</td><td>Shift the IR.</td></tr>
<tr><td>0x81</td><td>DR_SHIFT</td><td>Shift the DR.</td></tr>

<!--
<tr><td>0xA0</td><td>HALTCPU</td><td>Halt the CPU.</td></tr>
<tr><td>0xA1</td><td>RELEASECPU</td><td>Resume the CPU.</td></tr>
-->

<!--<tr><td>0xC0</td><td>GETDEVICE</td><td></td></tr>-->
<tr><td>0xC1</td><td>SETINSTRFETCH</td><td>Set CPU to Instruction Fetch state.</td></tr>
<tr><td>0xC2</td><td>SETPC</td><td>Set the Program Counter.</td></tr>
<!--<tr><td>0xC3</td><td>EXECUTEPOR</td><td></td></tr>
<tr><td>0xC4</td><td>RELEASEDEVICE</td><td></td></tr>-->

<tr><td>0xE0</td><td>WRITEMEM</td><td>Alias for POKE.</td></tr>
<tr><td>0xE1</td><td>WRITEFLASH</td><td>Write a word of flash memory.</td></tr>
<tr><td>0xE2</td><td>READMEM</td><td>Alias for PEEK.</td></tr>
<tr><td>0xE3</td><td>ERASEFLASH</td><td>Mass Erase</td></tr>

<tr><td>0xF0</td><td>COREIP_ID</td><td></td></tr>
<tr><td>0xF1</td><td>DEVICE_ID</td><td></td></tr>

</table>

<p>WRITEMEM and WRITEFLASH read and return the written value.  Client implementations
should throw an error during programming if the returned value does not match the
written value.  Insufficient writes commonly leave 0xA100.</p>
